Threat reportVulnerabilityTL-2026-3804
OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and ip_moptions Out-of-Bounds Write Chain Enables Local Privilege Escalation to Root (Public PoC)
OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and (TL-2026-3804), also tracked as Big Fish, is a high-severity software vulnerability, first published 2026-10-17. It has no confirmed attribution, affects OpenBSD Project OpenBSD kernel (SysV IPC shared memory / IP multicast, maps to 4 MITRE ATT&CK techniques (T1059.004, T1082, T1106), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3804
- Threat ID
- TL-2026-3804
- Also known as
- Big Fish
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, telecoms, education, managed-service-providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and works
A two-stage OpenBSD kernel exploit chain, published as 'Big Fish' by researcher Andrew Griffiths (Calif) on 2026-10-16, combines a 37-year-old signed 16-bit System V shared-memory attachment counter (shm_nattch) integer overflow/use-after-free with an out-of-bounds write affecting struct ip_moptions to reach root on OpenBSD 7.9, reportedly bypassing KARL, SMAP and SMEP. Public PoC code is available; OpenBSD addressed the shared-memory issues via errata 018 and 026.
Big Fish is a local privilege escalation (LPE) research chain against the OpenBSD kernel, published by Andrew Griffiths of Calif on 2026-10-16 alongside proof-of-concept code (big-fish.c, hosted in the califio/publications GitHub repository under MADBugs/openbsd/). The researcher states the root cause traces back roughly 37 years to original BSD source code: the System V IPC shared-memory attachment counter, shm_nattch, is declared as a signed 16-bit short in sys/sys/shm.h. Repeated attach/detach and process-fork activity can drive this counter past its signed maximum, causing it to wrap to a large negative value. Combined with a reference-counting error, this produces a use-after-free condition in the kernel's SysV IPC shared-memory subsystem. The flaw was reported to the OpenBSD project earlier in 2026, ahead of public disclosure.
At a high level, the published research describes a multi-stage chain rather than a single bug: (1) the shared-memory attachment counter is driven to overflow through repeated mapping/unmapping and process forking, producing a reference-count/use-after-free primitive; (2) kernel heap state is profiled using sysctl(KERN_MALLOCSTATS) statistics to infer allocator behavior, which is feasible because the OpenBSD kernel allocator is deterministic; (3) a timing race between object deallocation (IPC_RMID) and reattachment by a helper process is used to achieve a type/size confusion over freed kernel memory; (4) the confused memory is overlaid with an IP multicast socket option structure (struct ip_moptions, 16 bytes) created via setsockopt(IPPROTO_IP, IP_MULTICAST_TTL, ...); (5) a conditional out-of-bounds write corrupts fields within that structure; (6) subsequent socket teardown operations that walk the multicast group list provide a controlled write primitive against adjacent kernel memory, which is leveraged to corrupt a self-referential page-table-entry mapping and flip a page from user- to supervisor-writable; (7) this is used to overwrite a predictable kernel code/data pointer and obtain a root shell. The researcher reports this chain defeats OpenBSD's KARL (kernel address randomized link), SMAP, SMEP and ASLR protections on OpenBSD 7.9 (and potentially earlier releases sharing the same SysV IPC and multicast code paths).
This is strictly a local privilege escalation: an attacker requires pre-existing code execution (e.g., an unprivileged local shell, a compromised service account, or a sandboxed/jailed process capable of IPC and socket syscalls) on the target host; it grants no remote access or initial foothold on its own. No CVE identifier, CVSS score, or indicators of in-the-wild exploitation are present in any source reviewed; the HIGH severity in this record is an analyst assignment reflecting root-level local privilege escalation with a working public PoC, not a vendor- or NVD-assigned rating. No network-based IOCs exist for this threat since it is a local kernel exploit; the IOCs captured below are host/behavioral artifacts, file/code artifacts, and vulnerable-component identifiers useful for detection and asset inventory.
OpenBSD published two relevant errata for the 7.9 release: errata 018 (dated 2026-09-14, patch file 018_shmat.patch.sig, described by OpenBSD as a reliability fix to 'prevent integer overflow in shmat(4)', applicable to all architectures) and errata 026 (dated 2026-09-30, patch file 026_sysvipc.patch.sig, described by OpenBSD as a security fix for 'a reference counting bug [that] could lead to use-after-free in the kernel', applicable to all architectures). The researcher's own write-up cites exactly these two errata as addressing the shared-memory side of the chain; neither official errata description specifically mentions IP multicast or ip_moptions, so it is not confirmed by the sources reviewed whether the ip_moptions out-of-bounds-write primitive used in the later exploitation stages was independently patched or whether it was an exploitation technique riding on the same freed-memory condition. Defenders running affected OpenBSD releases should treat applying both errata as the primary remediation rather than relying on exploit mitigations such as KARL/SMAP/SMEP alone, per the original source's guidance. The researcher additionally proposes forward-looking kernel hardening not yet implemented upstream at time of writing: safe-unlinking for kernel doubly-linked lists, randomization of the self-referential page-table-entry mapping (e.g., via .openbsd.randomdata-style techniques), randomization of kernel allocator base addresses and allocation order, and compiler-based defenses such as array-bounds sanitizers and allocation-tagging ('Alloc Tokens') schemes.
MITRE ATT&CK techniques used in TL-2026-3804
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API
Discovery
T1082 System Information Discovery
Defense Evasion
Affected products and versions in OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and
- OpenBSD Project — OpenBSD kernel (SysV IPC shared memory / IP multicast socket options)
Vulnerable versions: OpenBSD 7.9 (and potentially earlier releases sharing the same shm_nattch and ip_moptions code paths)
Fixed in: OpenBSD 7.9 with errata 018 (018_shmat.patch.sig) and errata 026 (026_sysvipc.patch.sig) applied
Remediation for OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and
Patches
- OpenBSD 7.9 errata 018 — 018_shmat.patch.sig (2026-09-14) — prevents integer overflow in shmat(4)
- OpenBSD 7.9 errata 026 — 026_sysvipc.patch.sig (2026-09-30) — fixes reference-counting use-after-free in kernel SysV IPC
Immediate actions
- Apply OpenBSD 7.9 errata 018 (018_shmat.patch.sig) to prevent the shmat() integer overflow
- Apply OpenBSD 7.9 errata 026 (026_sysvipc.patch.sig) to fix the SysV IPC reference-counting use-after-free
- Audit which local users, services, or jailed/sandboxed processes have the ability to call shmget/shmat/shmctl and setsockopt(IPPROTO_IP, IP_MULTICAST_TTL) and restrict where not required
- Inventory all OpenBSD hosts for release version to confirm exposure to the shm_nattch / ip_moptions code paths prior to errata 018/026
Workarounds
- Restrict or disable unprivileged access to System V shared memory IPC primitives where not operationally required
- Restrict unprivileged processes' ability to create IP multicast sockets / set IP_MULTICAST_TTL where not operationally required
- Limit local shell/code-execution exposure on OpenBSD hosts (the chain requires an existing local foothold) via least-privilege account design and process sandboxing
Longer-term hardening
- Track upstream adoption of proposed kernel hardening: safe-unlinking for kernel linked lists, self-referential PTE mapping randomization, kernel allocator base-address/order randomization
- Evaluate compiler-based mitigations (array bounds sanitizers, allocation-tagging schemes such as Alloc Tokens) as they become available in OpenBSD toolchains
- Do not rely solely on KARL/SMAP/SMEP/ASLR as a substitute for patching, since this chain is reported to bypass all four
- Monitor the califio/publications GitHub repository and OpenBSD errata feed for follow-on advisories related to SysV IPC and IP multicast socket options
Weaknesses (CWE) in OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and
Timeline of OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and
- Researcher Andrew Griffiths (Calif) reports the shm_nattch / SysV IPC and ip_moptions kernel issues to the OpenBSD project earlier in 2026, ahead of public disclosure (exact report date not stated in sources).
- OpenBSD releases errata 018 (018_shmat.patch.sig) for OpenBSD 7.9, described as a reliability fix preventing integer overflow in shmat(4).
- OpenBSD releases errata 026 (026_sysvipc.patch.sig) for OpenBSD 7.9, a security fix for a reference-counting bug that could lead to kernel use-after-free.
- Public proof-of-concept exploit code (big-fish.c) is published in the califio/publications GitHub repository under MADBugs/openbsd/.
- Andrew Griffiths (Calif) publishes the 'Big Fish' research write-up at calif.io/research/big-fish detailing the full exploit chain.
- Threadlinqs threat hunting pipeline ingests the GBHackers article and opens threat TL-2026-3804 for research and tracking.
- GBHackers publishes an article summarizing the OpenBSD kernel flaw chain and public PoC, bringing broader attention to the research.
Sources cited for OpenBSD Kernel 'Big Fish' shm_nattch Integer Overflow and
- OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root
- Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD (research write-up)
- califio/publications — MADBugs/openbsd/big-fish.c (PoC source)
- OpenBSD 7.9 Errata 018 — shmat(4) integer overflow fix
- OpenBSD 7.9 Errata 026 — SysV IPC reference counting / use-after-free fix
Detection coverage for TL-2026-3804
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3804 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.